Iyuphi ikheli olibhalisa njengeklayenti le-RADIUS ku-NPS?
Bhalisa umthombo wangempela wangemuva we-gateway, hhayi igama lomsingathi lomphakathi noma iqembu lamaklayenti. Qondanisa imfihlo eyabiwe, bese uqinisekisa ngesicelo esisodwa esilawulwayo.
I-VPN gateway enikela ukuqinisekisa kwi-Windows NPS idinga into eyodwa ohlangothini lwe-NPS ngaphambi kokuba noma iyiphi inqubomgomo yomsebenzisi isebenze: umugqa weklayenti le-RADIUS we-gateway. Iningi lemizamo ehlulekayo libhalisa ikheli elingalungile, ngoba ikheli elibalulekile yilelo i-gateway elisebenzisa endleleni yayo yangemuva, hhayi igama lomsingathi abasebenzi abalithayipha kuhlelo lwabo lwe-VPN. Uma lelo nani lingalungile, i-NPS iyawushiya ngasese isicelo, okubonakala njengephasiwedi engalungile ohlangothini lweklayenti. Izimo ezintathu zinquma ukuthi yiliphi ikheli elisekisini, ngakho zixazulule ngaphambi kokuvula ikhonsoli.
Bhalisa i-gateway, hhayi amalaptop noma iqembu
Into yeklayenti le-RADIUS imele idivayisi yokufinyelela inethiwekhi ethumela izicelo zokuqinisekisa. Leyo yi-VPN gateway, hhayi wonke ilaptop eqhuba iklayenti, futhi hhayi uhla lwamakheli akhishwa ngaphakathi kwamathela.
Lawo makheli amathela awaveli njengomthombo wesicelo se-RADIUS, ngoba isicelo sihamba ngendlela yenethiwekhi ye-gateway uqobo. Ukubhalisa umugqa weqembu lamaklayenti kukhiqiza inqubomgomo engasoze ihambisane, kuyilapho isicelo sangempela sifika likheli i-NPS engakaze ilizwe. Leyo nkunguphambili efanayo yenza abantu bangeze i-IP yasekhaya yomsebenzi ngamunye, okungaphethwe futhi okungalungile.
Izimo ezintathu zinquma ikheli olifakayo
Okokuqala, thola ikheli lomthombo i-gateway elisebenzisa ngempela ngase-NPS. I-gateway enezindawo eziningi zokuxhumana ivamise ukuthumela isuka endaweni yokuphatha noma yangemuva esikhundleni somlaleli we-VPN womphakathi. Okwesibili, hlola ukuthi kukhona i-NAT phakathi kwakho kokubili: uma isicelo sihunyushwa, i-NPS ibona ikheli elihunyushiwe, futhi yilo nani okufanele libhaliswe. Okwesithathu, uma ama-gateway amabili abelana indima, umthombo ngamunye wesicelo udinga umugqa wakhe weklayenti, ngoba into eyodwa enekheli elilodwa ihlanganisa owodwa kuphela wabo.
Irekhodi elineziphetho ezimbili ligcina izithandani ziqondile. Ithebula elingezansi lisebenzisa amakheli angasese njengesibonelo, ngakho faka lawo indlela yakho ewasebenzisa ngempela.
| At NPS | At the VPN gateway |
|---|---|
| RADIUS client address 10.20.0.10 | Authentication server 10.20.0.20 |
| Shared secret, agreed value | The same secret, same value |
| UDP 1812 permitted from 10.20.0.10 | UDP 1812 permitted toward 10.20.0.20 |
Qinisekisa umthombo esikhundleni sokuqagela. Buka ilogi ye-NPS noma ye-firewall phakathi nomzamo owodwa, noma thatha ukubamba kusihloko se-NPS nge-sudo tcpdump -ni any udp port 1812. Ikheli elikulokho kubamba yilona kuphela impendulo evikelekayo yomugqa weklayenti. Uma i-gateway inemithombo eminingana engaba khona, bhalisa ngamunye ngaphansi kwegama lalo elisebenzisekayo.
Imfihlo eyabiwe iyinani eliphakathi kwe-gateway ne-NPS
Imfihlo eyabiwe iqinisekisa ubuhlobo bedivayisi. Akuyona iphasiwedi yomsebenzisi futhi ayikaze isatshalaliswe kubasebenzi noma ifakwe kumaphrofayili eklayenti.
Khetha inani elilodwa, lifake kuzo zombili izindawo, futhi uligcine lapho kugcinwa khona ikhophi yokulungiselela ye-gateway. Ukungafani kukhiqiza isicelo i-NPS eyilahla ngaphandle kwephutha eliwusizo, okungenakuhlukaniswa nesikhungo esingafinyeleleki kulogi ye-gateway. Yishintshe ngesikhathi sokuphatha futhi ubuyekeze iziphetho zombili kushintsho olulodwa.
Qinisekisa ngesicelo esisodwa esivunyelwe
Sebenzisa i-akhawunti elawulwayo futhi uhlobanise umzamo owodwa kuzo zombili izinhlangothi. Ku-gateway, qinisekisa ukuthi isicelo siphume saya kwisikhungo esihlosiwe; ku-NPS, qinisekisa ukuthi safika sasuka kuklayenti elibhalisiwe futhi sahlangana nenqubomgomo yecelo lokuxhumana elindelekile. Ukuphela kwesikhathi nokunqatshwa kusho izinto ezihlukene, futhi ukubona kokubili njengenkinga yobufakazi bokungena kudla ihora elilandelayo. Bese uhlola i-akhawunti evumelekile kodwa engafaneleki kanye nephasiwedi engalungile, ngoba inqubomgomo eyamukela konke nayo iphumelela isivivinyo sokuqala.
Ekugcineni, hlola ukuthi i-gateway yenzani ngemvume ebuyisiwe. Ukubhalisa iklayenti le-RADIUS kuvumela idivayisi ukuthi ibambe iqhaza kuphela; akuniki wonke umkhumbi ovelayo ukufinyelela ku-LAN.
Gcina umphumela wokuxilonga usemkhawulweni: akukho mfihlo eyabiwe, akukho phasiwedi yomsebenzisi, akukho mthwalo ogcwele wephakethe kuthikithi lokusekelwa. Uma idizayini idinga ukuthi isikhungo se-NPS sifunde izimfanelo zohlu lwemibhalo, leyo mvume iwumsebenzi wokuphatha ohlukile ekubhalisweni kweklayenti, futhi yehluleka ngendlela ehlukile uma ingekho.